I'm trying to automate some of my debugging with a python script that automatically places breakpoints at the first and last instructions of the functions I want to analyze. I'm using the breakpoint's condition to call python code whenever the breakpoint is hit, so I can print a line of text on the console.
These functions have arguments that I want to interact with in the breakpoint's condition code from Python, but I don't know how to access them. Take the following function for example:
.text:00E072A0 ; char __thiscall encryptDataLong(int this, int inData, int outData, size_t bufferSize) .text:00E072A0 encryptDataLong proc near ; CODE XREF: encryptData+D↓j .text:00E072A0 ; encryptPw+245↓p .text:00E072A0 .text:00E072A0 var_14= dword ptr -14h .text:00E072A0 var_10= dword ptr -10h .text:00E072A0 var_C= dword ptr -0Ch .text:00E072A0 var_8= dword ptr -8 .text:00E072A0 var_4= dword ptr -4 .text:00E072A0 inData= dword ptr 4 .text:00E072A0 outData= dword ptr 8 .text:00E072A0 bufferSize= dword ptr 0Ch .text:00E072A0 .text:00E072A0 sub esp, 14h ; <-- Breakpoint here
The second and third arguments are pointers to a chunk of memory, and the last argument is the size of this memory. I want to access all three arguments (the two pointers and the size) from python code, but I don't know how to do it. When I hover my mouse over an argument in the pseudocode view, i get something like this on the tooltip:
int inData; // [esp+1Ch] [ebp+4h]
But I don't know how to extract the actual pointers form this in python. I assume the parameters are stored relative to one of the registers (e.g.
esp in this case), and the number after the
+ sign is the offset in memory relative to this register's value, but when manually investigating the running program's memory, I found that this is not the case.
What do those two register offsets mean on the tooltip, and how can I use them in together with
get_bytes to get the actual data in the arguments?
PS: I have found the
idaapi.get_arg_addrs(here()) function from the accepted answer on this question, but when running it in the python console while the program is paused on the first instruction of the function, it doesn't return anything. This question also mentions
get_arg_addrs, but it seems to be used on the
call instruction, and not on the function itself. In my case, I want to get the arguments from within the function, when the program is paused on the first instruction.